NovaiguNovaigu
Request a demo

Maturity assessment

How mature is your OT security?

Review the security controls and technology you have in place across 24 practices. See which of four maturity stages you have reached, where the gaps are, and what to implement next.

  • 24 practices, about five minutes
  • Mapped to NIST CSF 2.0
  • Your answers stay in your browser
Start the assessment

Four stages

Four stages of OT security maturity

Each stage builds on the controls below it: essential cyber hygiene, then visibility and access control, then detection and response, then a threat-informed program that keeps improving.

  1. Stage 1

    Foundation

    Essential cyber hygiene

    • Endpoint protection and offline backups
    • A default-deny IT/OT firewall
    • Unique credentials, no defaults
  2. Stage 2

    Managed

    Visibility, segmentation and access control

    • Automated asset discovery
    • Zones, conduits and an IDMZ
    • Brokered remote access with MFA
  3. Stage 3

    Proactive

    Detection, response and recovery

    • OT network security monitoring
    • Exercised OT response playbooks
    • 24/7 SOC coverage
  4. Stage 4

    Optimized

    Threat-informed and adaptive

    • Adversary emulation
    • Threat hunting with ATT&CK for ICS
    • Annual maturity measurement

The assessment

Select what you have in place today

A practice counts when it is implemented at every site, not planned or in progress.

Stage 1

Foundation

Essential cyber hygiene

0/6
Business network (IT)Control network (OT)

Select each control you have in place. Point at an icon to see exactly what it covers.

Stage 2

Managed

Visibility, segmentation and access control

0/6
Enterprise · Levels 4 and 5Industrial DMZControl · Levels 0 to 3

Select each control you have in place. Point at an icon to see exactly what it covers.

Stage 3

Proactive

Detection, response and recovery

0/6
OT networkSecurity operations

Select each control you have in place. Point at an icon to see exactly what it covers.

Stage 4

Optimized

Threat-informed and adaptive

0/6

Select each control you have in place. Point at an icon to see exactly what it covers.

0Stage reachedGetting started

Each practice is mapped to the NIST Cybersecurity Framework 2.0, and the stages follow the same progression as ISA/IEC 62443, C2M2, CIS Controls and the SANS ICS Five Critical Controls. This self-assessment is indicative, not a certification: a formal assessment measures each control against the full requirements of the standard at every site.